KYC and KYB requirements for fintechs

Which rule applies to you

Many fintechs meet the strictest of these even when a looser one applies, because the partner bank requires it and because switching programs later is expensive.

KYC: individual customers

The bank CIP rule sets a baseline that most fintech onboarding follows. Before opening an account, a bank must obtain at least:

• name
• date of birth, for an individual
• address, which for an individual is generally a residential or business street address
• an identification number, which for a U.S. person is a taxpayer identification number

The institution must then verify identity within a reasonable time, using documents, non-documentary methods or both, keep records of what it did, check government lists where required, and give customers notice that their identity is being verified.

Verification in practice combines several checks: document capture and authentication, data matching against credit bureau or other sources, device and behavior signals, and, for higher-risk cases, manual review. No single check is enough on its own; the program should say which combination applies to which risk level.

KYB: business customers

Business onboarding has two parts: verifying the entity, and identifying the people behind it.

Verifying the entity

• Legal name, formation state and entity type, checked against the state's business records (for Texas entities, the Secretary of State)
• Employer identification number
• Principal business address and operating address
• What the business does, its expected activity and its website or other public footprint
• Licenses the business needs for its own activity, where relevant

Identifying beneficial owners

The CDD rule requires covered financial institutions, including banks, to identify and verify the beneficial owners of legal-entity customers when an account is opened. It uses two prongs:

The rule has exclusions for certain entity types, such as publicly traded companies. Money services businesses are not among the covered financial institutions the CDD rule lists, but a partner bank will usually apply it to the fintech's business customers.

What changed with the Corporate Transparency Act

The Corporate Transparency Act created a separate FinCEN database of beneficial ownership information. In March 2025 FinCEN issued an interim final rule that exempts entities created in the United States from reporting, leaving the requirement on certain foreign entities registered to do business in a U.S. state. Because most U.S. companies no longer file, do not design KYB around being able to check a filing. Check fincen.gov for the current rule before relying on it.

Ongoing due diligence

KYC is not finished at onboarding. The CDD rule expects banks to understand the nature and purpose of each customer relationship, build a customer risk profile, monitor on an ongoing basis, and update customer information when monitoring turns up something relevant. For a fintech, that means:

1. Score customers at onboarding using factors from your risk assessment: product, geography, expected volume and business type.
2. Compare activity with the profile. A sole trader expecting small payments who starts moving large sums is an alert, not a success story.
3. Refresh information on a trigger, such as a change in ownership, a sanctions or adverse media hit, or unusual activity, and periodically for higher-risk customers.
4. Apply enhanced due diligence to higher-risk customers: source of funds, more documents, senior sign-off.
5. Document exits. When you close an account for risk reasons, record why, and check whether a report is required.

Designing onboarding that holds up

• Collect only what your program needs, and say why you need it. Identity data is sensitive personal data under privacy laws; see the Texas privacy guide.
• Store the evidence of each check, not just a pass or fail result, so you can show an examiner what happened.
• Give customers a route to fix a failed check, and a human review for edge cases.
• Use the same identity record across products, so a customer who fails in one place is not approved in another.
• Test vendors for accuracy and bias before relying on them, and monitor their results over time.

Common questions

Is KYC legally required for a fintech app?

It depends on what the app does. Banks and money services businesses have specific identification obligations, and fintechs operating through a bank almost always carry out the bank's requirements. A pure software product that never touches money may have none, though sanctions rules still apply.

What is the beneficial ownership threshold?

Under the CDD rule, an individual who owns 25 percent or more of a legal-entity customer is a beneficial owner, and one individual with significant control must also be identified.

Can we open accounts before verification is finished?

The bank CIP rule requires verification within a reasonable time and requires the program to say what happens when identity cannot be verified. Many programs restrict what an unverified account can do. Your partner bank's program will decide the specifics.

Do sole proprietors go through KYC or KYB?

A sole proprietor is an individual, so the individual checks apply, usually alongside business information such as a trade name and the nature of the business.

How onboarding fits the wider program is covered in building a BSA/AML program.